Risk ManagementFor Projects

Google

• “Risk Management” About 245,000,000 results (0.80 seconds)

• “Chemical Engineering” About 124,000,000 results (0.88 seconds)

Risk Management is Everywhere

List some examples of risk management

Why Risk Management?

• Everyone plans for success

• Things happen because we didn’t see them and plan for them, but what if we had?

• Risk management and timely response is what makes the difference between success and failure.

Risk Management

• https://www.youtube.com/watch?v=63nnrnWl3sI

Risks In Our Projects

1. Phase I - Risks to Our Project – Schedule Risk - not delivering a report by April– Quality Risk – not delivering on objectives– Cost Risk– Assessed & Managed in our PP and execution

2. Phase I - Risks in Our Recommendations– Assessed in our Reports, – Managed by client

Software Projects

Standish Chaos 2015 report

Only 1/3 of projects deliver all their project

objectives

Risk is

• Risks are the uncertainty in not delivering the project objectives

• Managing Risks is about scanning the future to see problems.

• Focus on the things that “really” matter

Risk = Probability x Consequences

• Must be uncertain– Not an existing problem– Not constraints, or requirements– Not issues, or problems

• Must matter– Which objective would be affected?

• How risky?– How uncertain?– How much will it matter?

Risk = Probability x Consequences

• Ethan has Uncertainty in…

• Good and Bad Consequences

What Matters?

• CEO of BP oil in 2007 vowed to make safety a top priority

• Among the new rules he instituted were the requirements that all employees use lids on coffee cups while walking, and refrain from texting while driving.

– Harvard Business Review

What Matters

• Things that waste money

• Things that could hurt a person

• Things that destroy reputation

• Things that waste time

• Things that can help! – embrace the ones that have positive effects

• It’s not just the bad uncertainties that need to be managed.

What is the Cheese in Your Project?

• Risks can be opportunities or threats

• Take a minute discuss what Threats & Opportunities to your objectives might be present.

– For the project

– For yourself personally

Rigorous Approach: Risk Management Process

• Define Objectives: What are we trying to achieve?

• Define Uncertainties that would matter (+ / -)– What could affect us achieving it?

• Prioritize: How uncertain, how much does it matter?– Which are most important?

• Define Responses: What should I do about it?

• Do it!

• Did it work? What’s Changed?

Identification

• How do we find all the risks?– We can’t.

• We can find the ones we know about.– Brainstorming / workshops

– Checklists

– Assumption analysis

– Interviews, questionnaires

– Others

• But ask are these “real risks?”

What is not a risk?

Cause Fact We don’t have enough peopleThe project is hardThe client hasn’t signed the SOW

Issues

Risk Uncertainty The reason we’re latePeople may be slow replying to Us

These are “Risk Factors”

Effect Possible result We could be late

PMD – “Risk Factors”Medical Risk

• Cause of a disease is the presence of a bacteria in your body.

• Risk Factors would be the things a person does, or situations that would expose them to the bacteria– Eating food from a street vendor might introduce..

– Drinking water that hasn’t been treated could ..

• Effects – dehydration, nausea, ..

Causes/ Risks / Effects

• Causes: Are true today • Risk: Uncertainty -> PMD calls these “risk factors”• Effect: is why it matters to our project

The project is in a 3rd world country

Interest rates might go down

We could go over budget

The weather might be unusual

I’m allergic to prawns

We’re using an unproven technique

It might not work for some reason

We don’t have enough people

We might be late

cause

risk

effect

risk

cause

cause

cause

effect

effect

Cause/Risk/Effect ?

The current hardware is not fast enough to support testing. This means

that we may be unable to test performance until production hardware is

used.

A number of usability issues have been identified by the supplier who plans

to raise change requests

Extra work may be identified at the detailed design gateway as the full

statement of work is not available at project start

The team does not have a documented design for the XYZ function.

Therefore there is chance that the architecture may not support the required

functionality, resulting in the requirements not being met and/or a higher

number of defects.

The development team may not perform the tests in the order laid out in the

schedule. This could result in the dates and quality of deliverable being

unpredictable.

One contractor left in week 36, another joined in week 37. The inevitable

disruption is not catered for by contingency.

Given the high number of builds to be carried out, test cycles may take

longer than planned which will consume significant additional amounts of

time and resources.

Source: https://www.youtube.com/watch?v=fVIqy51oyS4 Managing Risk in Practice “Workshop”, time = 21:30

Every Risk Entry – 3 elements

1. Existing Condition: Cause

2. Uncertain Event: Risk

3. Which would Lead to: Effect

Try to describe your risks with these three parts

Your list of Opportunities

• Rewrite your list of Opportunities as:

Objective Influenced

Cause / Risk (Factors) / Effect

Risk Breakdown Structure – (looks like a WBS!)

Technical

Requirements

Technology

Complexity an/or interfaces

Performance

Reliability

Quality

External

Regulatory (JHA)

Subcontractors/ supliers

Market conditions

Customers

Weather

Site restrictions

Organizational

Project authorities

Governance

Resources

Dependencies

Funding

Project Management

Estimating

Planning

Controlling

Communications

PREFIX With

Uncertainty In

Can be used for reports, Software development or anything that fits a definition of a project. The following is an example for a report on a new

business opportunity

Research

Requirements

Previous studies

interviews

Site visit

Hypothesis

Planning

Designing

Testing/ modeling

estimate

Economic modeling

Report preparation

Report

drawings

presentation

Printing/ binding

Report delivery

presentation

rehearsals

Question

delivery

PREFIX With

Uncertainty In

Planning Risk Responses

• What should we do?

– Based on:

• Type & nature of risk

• Manageability

• Impact

• Resource availability

• Costs

Who’s going to do it?

Typical response strategies

• Strategy before Tactics

– Eliminate uncertainty – avoid

– Transfer liability ownership – avoid

– Reduce to acceptable – reduce

– Control & Manage residual – accept

What about opportunities?

Opportunities

Threat

• Avoid – Eliminate

• Transfer - allocate

• Reduce - modify exposure

• Accept – include in baseline

Opportunity

• Exploit

• Share opportunity

• Enhance – more likely and bigger impact

• Accept & see what happens

Example risk sheetPROJECT:

CATEGORY

DATE REV # H

M

L

L M H

Score 4

0

0

PAA

#

DESCRIPTION:

WHEN

IMPACT

LIKELIHOOD IMPACT

LIK

ELIH

OO

D

RANK

@ risk K$/mo. RESERVE

CLOSURE

RESPONSE

ACTION WHO

COST IMPACT

SCHEDULE IMPACT

QUALITY IMPACT

PUBLIC/POLITICAL IMPACT

RISK # Wellington RISK NAME:

RISK OWNER:

• Objective • Cause• Risk Factors

Early on, RisksCan be a check ofyour objectives.

Summarize in Risk Register

• Tool used to capture the identified risks, their impacts and probability and the steps that need to be taken

• Used as an interactive tool to monitor progress of risk responses

• Assigns responsibility for risk actions

A Better Matrix

9 36 81

4 16 36

1 4 9

Probability

Consequences

1 4 9

9

4

1

Square the Value to increase the prioritization!

Implement Responses

• You haven’t done anything if all you’ve done is to make a decision.

• Same with any project plan, or risk management plan.

• Move Risks to an “issues/problems” list

In addition.. Process

• Take Action to Manage not just analyse

• Periodic Risk Reviews– New risks. Look at how risks have changed.

• Determine if risk responses have worked– Additional risk responses

• Assess process as a whole and Improve

Implementing Responses

• Who and How??

• Who should own risk?– Person or part best able to manage it effectively

– Owner of objective that would be affected

• How to make it happen?– Allocate Resource/budget/time for actions

– Add specific activities to project plan

– Monitor/report/review responses

People !

• Processes and computers do not manage risk

• People do, and they’re complicated

People’s emotional response

Response By A Population

ScaredBy Risk

ExcitedBy Risk

Emotional response

Start a new project, You have no experience, it’s a new client, uncertain requirements, and , and

Yikes!

Bring it On!

Where you should be depends on the situation. Sometimes:• Must be risk adverse• Must be adventurous• Just deal with it

Key Learning Points

• Risk is “uncertainty that matters”

• Includes both threats and Ops

• Need to separate cause-risk-effect

• Structured descriptions are helpful

• Select appropriate Risk response strategy

• Turn strategy into actions

• Remember it’s about people

Translate and Implementation

• Clearly we need a risk management plan/process as part of our project plan

– not a big one

• We need a Risk breakdown structure

• We need a risk register

• We need an issues list